> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.nvidia.com/nemoclaw/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/nemoclaw/_mcp/server. # Common NemoClaw Integration Policy Examples > Guided examples for adding post-install integration policy access to a NemoClaw sandbox. Use these examples when a sandbox is already installed and an integration needs network access. This page covers only integrations that NemoClaw currently ships as maintained policy preset YAML under `nemoclaw-blueprint/policies/presets/`. For complete blueprint examples that combine a model, agent harness, OpenShell policy, and integration workflow, refer to [Community Solutions](../resources/community-contributions). Integration setup usually has two separate parts: * Configure the integration itself, such as a bot token, OAuth credential, or agent plugin setting. * Allow the sandbox to reach the integration's network endpoints through NemoClaw and OpenShell policy. Use NemoClaw commands for policy changes that should be tracked with the sandbox. Use OpenShell directly when you need to inspect blocked requests or approve a one-off request in the TUI. ## Before You Start Replace `my-assistant` with your sandbox name in the examples. Check the current policy state first: ```bash nemohermes my-assistant policy list ``` For a live view of blocked requests, open the OpenShell TUI in a separate host terminal: ```bash openshell term ``` When the agent reaches an endpoint that is not in the policy, the TUI shows the host, port, requesting binary, method, and path when available. Approve a request only when you understand why the integration needs it. An approval updates the running policy, but it does not create a reviewable NemoClaw preset entry that `policy add` can replay. ## Supported Integration Presets NemoClaw ships maintained policy presets for common services in `nemoclaw-blueprint/policies/presets/`. Messaging channel presets are scoped to the sandbox's active agent; if an agent does not have a matching channel policy, that channel preset is omitted from `policy list` and `policy add ` reports it as unknown. | Workflow | Preset | Agent support | | ---------------------------------------------- | ------------------ | ------------------- | | Brave Search | `brave` | OpenClaw | | Homebrew packages | `brew` | OpenClaw and Hermes | | Discord messaging | `discord` | OpenClaw and Hermes | | GitHub and GitHub API | `github` | OpenClaw and Hermes | | Gmail IMAP and SMTP | `gmail` | OpenClaw and Hermes | | Google Chat messaging (experimental) | `googlechat` | OpenClaw | | Hugging Face Hub and Inference API | `huggingface` | OpenClaw and Hermes | | Jira and Atlassian Cloud | `jira` | OpenClaw and Hermes | | Local Ollama or vLLM through the host gateway | `local-inference` | OpenClaw and Hermes | | Microsoft Teams messaging (experimental) | `teams` | OpenClaw and Hermes | | OpenClaw model-pricing reference fetch | `openclaw-pricing` | OpenClaw | | npm and Yarn packages | `npm` | OpenClaw and Hermes | | Microsoft 365, Outlook, and Graph API | `outlook` | OpenClaw and Hermes | | Public reference APIs | `public-reference` | OpenClaw and Hermes | | Python Package Index | `pypi` | OpenClaw and Hermes | | Slack messaging | `slack` | OpenClaw and Hermes | | Tavily Search | `tavily` | OpenClaw and Hermes | | Telegram Bot API | `telegram` | OpenClaw and Hermes | | Weather and geocoding APIs | `weather` | OpenClaw and Hermes | | WeChat (personal) iLink Bot API (experimental) | `wechat` | OpenClaw and Hermes | | WhatsApp Web messaging (experimental) | `whatsapp` | OpenClaw and Hermes | Preview the endpoints before applying: ```bash nemohermes my-assistant policy add outlook --dry-run ``` NemoClaw generates the preview from the preset policy YAML that `policy add` would apply. It lists hosts, ports, access, protocol, TLS, and enforcement settings, HTTP methods and paths, and the binary allowlist. Apply the preset: ```bash nemohermes my-assistant policy add outlook --yes ``` Remove it later if the sandbox no longer needs that access: ```bash nemohermes my-assistant policy remove outlook --yes ``` ## Email and Calendar With Microsoft 365 Use the `outlook` preset for Microsoft 365 email and calendar workflows that use Microsoft Graph or Outlook endpoints. The preset allows access to `graph.microsoft.com`, Microsoft login, and Outlook service endpoints. ```bash nemohermes my-assistant policy add outlook --dry-run nemohermes my-assistant policy add outlook --yes ``` When the `outlook` preset is already applied, `policy add outlook` compares the preset with the live policy. If they match, the command exits zero without changing the live policy. If they differ, the command applies the preset again. This includes changes to the preset file. You do not need to remove the preset before you apply it again. Removing it first temporarily deletes its entries from the live policy. Then configure the email or calendar tool credentials through the integration you run in the sandbox. Keep OAuth client secrets and refresh tokens out of policy files. If the tool still fails, run `openshell term`, trigger the workflow again, and inspect the blocked request. If the blocked endpoint is not covered by the maintained `outlook` preset, treat it as a separate policy review instead of assuming it is part of the supported preset. ## Telegram Bot Messaging Telegram needs channel configuration and egress policy. If you already enabled Telegram during onboarding but did not include the preset, add it to the running sandbox: ```bash nemohermes my-assistant policy add telegram --yes ``` To add Telegram after onboarding, set the token on the host, add the channel, rebuild so the image picks up the channel config, and apply the policy preset: ```bash export TELEGRAM_BOT_TOKEN= NEMOCLAW_NON_INTERACTIVE=1 nemohermes my-assistant channels add telegram nemohermes my-assistant rebuild nemohermes my-assistant policy add telegram --yes ``` If delivery fails, open the TUI and send a test message to the bot: ```bash openshell term ``` The matching preset uses the channel name: `telegram`, `discord`, `slack`, `wechat`, `whatsapp`, or `teams`. OpenClaw also uses the `googlechat` preset. ## Slack or Discord Messaging Slack and Discord also need channel configuration and egress policy. Use the matching policy preset after you configure the channel credentials. For Slack: ```bash export SLACK_BOT_TOKEN= export SLACK_APP_TOKEN= NEMOCLAW_NON_INTERACTIVE=1 nemohermes my-assistant channels add slack nemohermes my-assistant rebuild nemohermes my-assistant policy add slack --yes ``` For Discord: ```bash export DISCORD_BOT_TOKEN= export DISCORD_SERVER_ID= NEMOCLAW_NON_INTERACTIVE=1 nemohermes my-assistant channels add discord nemohermes my-assistant rebuild nemohermes my-assistant policy add discord --yes ``` If you enabled Slack or Discord during onboarding, apply only the matching preset: ```bash nemohermes my-assistant policy add slack --yes nemohermes my-assistant policy add discord --yes ``` ## WeChat or WhatsApp Messaging (Experimental) WeChat and WhatsApp are experimental. Both rely on QR-based pairing flows that are more fragile than token-based bots. The upstream client libraries can change behavior without notice. WeChat uses Tencent's iLink Bot API for personal accounts. A host-side QR scan captures the bot token during onboarding rather than requiring you to paste it from a developer portal. Add the channel interactively and apply the preset: ```bash nemohermes my-assistant channels add wechat nemohermes my-assistant rebuild nemohermes my-assistant policy add wechat --yes ``` WhatsApp Web pairs entirely inside the sandbox through QR scan, so `channels add` does not collect a host-side token. Apply the preset and complete the in-sandbox pairing after the rebuild: ```bash NEMOCLAW_NON_INTERACTIVE=1 nemohermes my-assistant channels add whatsapp nemohermes my-assistant rebuild nemohermes my-assistant policy add whatsapp --yes ``` If you enabled WeChat or WhatsApp during onboarding, apply only the matching preset: ```bash nemohermes my-assistant policy add wechat --yes nemohermes my-assistant policy add whatsapp --yes ``` ## GitHub and Jira Use `github` when the agent needs GitHub API access or Git access. Use `jira` when the agent needs Atlassian Jira access. Preview first: ```bash nemohermes my-assistant policy add github --dry-run nemohermes my-assistant policy add jira --dry-run ``` Apply the preset that matches the workflow: ```bash nemohermes my-assistant policy add github --yes nemohermes my-assistant policy add jira --yes ``` The `jira` preset intentionally allows Node.js access to Atlassian Cloud and does not allow `curl`. When validating it manually, avoid plain `curl -s` against `auth.atlassian.com`. Atlassian can return an empty redirect body even when the request succeeds. An empty `curl -s` output from that endpoint is inconclusive before or after approval. Do not use it as a pass/fail signal. Use a body-visible API probe instead: ```bash node -e "require('https').get('https://api.atlassian.com', r => console.log(r.statusCode))" curl -sS --max-time 10 -w '\n%{http_code}\n' https://api.atlassian.com/oauth/token/accessible-resources ``` Before approval, the curl probe should report `000` or a local policy denial. After explicitly approving curl for `api.atlassian.com` in OpenShell, it should return Atlassian's unauthenticated `401` JSON response. The `401` response is the expected success signal for this manual probe. This manual probe proves curl reached Atlassian, but no Jira credentials were supplied. Remove access when the task is done: ```bash nemohermes my-assistant policy remove github --yes nemohermes my-assistant policy remove jira --yes ``` ## Web Search Web search requires both the selected provider's credential and its matching network policy preset. Onboarding suggests `brave` or `tavily` only when you selected that provider, including under the Restricted tier. If you unselected or removed the matching preset, preview and add it before using web search. Hermes supports Tavily Search through NemoClaw onboarding and does not support Brave Search. Apply the `tavily` preset if it is missing. ```bash nemohermes my-assistant policy add tavily --dry-run nemohermes my-assistant policy add tavily --yes ``` Rerun onboarding when you enable or disable Tavily because the Hermes backend and OpenShell credential attachment are part of the sandbox image. Configure `TAVILY_API_KEY` during that onboarding run. The `tavily` preset permits only `POST /search` and `POST /extract` to `api.tavily.com`. It enables request-body credential rewriting because Hermes sends its resolver placeholder in the JSON `api_key` field. OpenShell replaces that placeholder at egress, so the raw key is not written into the sandbox configuration. ## Weather and Public Reference Lookups Use the `weather` preset when the agent needs read-only weather or geocoding lookups. The Open tier includes it by default. Balanced and Restricted sandboxes require the explicit `policy add weather` step below. The preset covers read-only public weather and geocoding lookups, including current conditions, forecasts, geocoding, and weather alerts, without enabling messaging or productivity APIs. ```bash nemohermes my-assistant policy add weather --dry-run nemohermes my-assistant policy add weather --yes ``` Use the `public-reference` preset when the agent needs read-only public reference APIs, such as Wikipedia, Wikidata, Wikimedia Commons, Nominatim, or country metadata. The Open tier includes this preset by default. ```bash nemohermes my-assistant policy add public-reference --dry-run nemohermes my-assistant policy add public-reference --yes ``` ## Package and Model Tooling Use these presets when an agent workflow needs to install packages or download model assets: | Workflow | Preset | | ----------------------------------------------------- | ------------- | | npm or Yarn packages | `npm` | | Python packages from PyPI with `pip`, Python, or `uv` | `pypi` | | Homebrew packages | `brew` | | Hugging Face model or dataset access | `huggingface` | Add only the preset required for the task: ```bash nemohermes my-assistant policy add npm --yes nemohermes my-assistant policy add pypi --yes nemohermes my-assistant policy add brew --yes nemohermes my-assistant policy add huggingface --yes ``` Remove package access after a one-time setup task if the sandbox no longer needs it: ```bash nemohermes my-assistant policy remove npm --yes nemohermes my-assistant policy remove pypi --yes nemohermes my-assistant policy remove brew --yes nemohermes my-assistant policy remove huggingface --yes ``` The `pypi` preset allows Python, `pip`, virtual-environment Python and `pip`, and `/usr/local/bin/uv` to reach PyPI endpoints. If `uv` is installed somewhere else in the sandbox, add a custom preset for that binary path instead of broadening the maintained preset locally. ### Homebrew Specifics The sandbox base image includes Homebrew (Linuxbrew), so apply the `brew` preset before installing a formula. A `/usr/local/bin/brew` wrapper puts the entry point on the sandbox `PATH` while delegating to the Linuxbrew prefix. Installed formula commands are available from the Linuxbrew bin directory in sandbox shell sessions: ```bash nemohermes my-assistant policy add brew --yes nemohermes my-assistant exec -- brew install nemohermes my-assistant exec -- bash -lc '' ``` You do not need to bootstrap Homebrew, install build dependencies, or source `brew shellenv` inside the sandbox. ## Model Pricing Hermes does not use OpenClaw's model-pricing reference fetch. ## Local Inference Use `local-inference` when the sandbox needs access to host-side local inference services such as Ollama or vLLM through the OpenShell host gateway. Onboarding auto-suggests this preset when you choose a local provider. If you need to add it after onboarding: ```bash nemohermes my-assistant policy add local-inference --dry-run nemohermes my-assistant policy add local-inference --yes ``` Then verify the sandbox status: ```bash nemohermes my-assistant status ``` ## Gmail With an App Password Use the `gmail` preset for Python IMAP or SMTP workflows that use a dedicated Gmail App Password. Follow [Set Up Gmail With an App Password](set-up-gmail-with-an-app-password) for the security boundary, prerequisites, examples, and cleanup steps. ## Inspect or Replace the Live Policy Use `policy list` for normal preset state. Follow [Replace the Live Network Policy](configure-policies/replace-live-network-policy) only when you need to export, edit, and replace the complete policy. Use [Apply Policy Presets](configure-policies/apply-policy-presets) to merge maintained or custom preset entries. ## Next Steps * [Approve or Deny Agent Network Requests](approve-network-requests) for the interactive OpenShell TUI flow. * [Customize the Sandbox Network Policy](customize-network-policy) to choose the correct policy workflow. * [Set Up Gmail With an App Password](set-up-gmail-with-an-app-password) for the full Gmail IMAP and SMTP workflow. * [Choose Messaging Channels](../manage-sandboxes/messaging-channels/choose-messaging-channels) for Telegram, Discord, Slack, WeChat, WhatsApp, Microsoft Teams, and Google Chat configuration. * [Commands](../reference/commands) for the full `policy get`, `policy add`, `policy list`, `policy remove`, and `channels` command reference.